canvas-student-enrollment-manager
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its handling of untrusted external data.
- Ingestion points: The skill reads student information (names and emails) from a CSV file on the filesystem using
filesystem-read_filein the first step of its workflow. - Boundary markers: There are no instructions to use delimiters, XML tags, or other boundary markers to isolate the content of the CSV fields from the agent's instructions.
- Capability inventory: The skill possesses the capability to modify LMS state via
canvas-canvas_enroll_userand communicate with users viacanvas-canvas_create_conversation. - Sanitization: The instructions lack guidance for the agent to sanitize or validate the 'Name' field before using it to personalize private messages. This creates a surface where malicious instructions embedded in a student's name could influence the agent's behavior during message generation.
- [NO_CODE]: The analyzed skill consists entirely of markdown instructions and reference templates. No executable scripts (e.g., Python, JavaScript, Shell) were detected in the skill package, which reduces the risk of traditional remote code execution or malware persistence.
Audit Metadata